DCERPC SMB Spoolss Named Pipe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.